When senior management accepts a level of residual risk that the CAE believes is unacceptable to the organization, the CAE should:
a. Report the unacceptable risk level immediately to the chair of the audit committee and the independent outside audit firm partner.
b. Resign his or her position in the organization.
c. Discuss the matter with knowledgeable members of senior management and, if not resolved, take it to the audit committee.
d. Accept senior management’s position because it establishes the risk appetite for the organization.